AI Weekly Malaysia

Wiz Research found that 294 of 3,074 internet-facing LiteLLM gateways scanned in February accepted 'sk-1234', the example admin key from LiteLLM's own setup guide. 191 of those had no master key set at all, meaning they accepted any credential. The master key is both the admin credential and the authentication switch—before v1.82.0-stable, a gateway with no key granted full admin rights to every request, exposing all stored provider API keys, prompt traffic, MCP tool connections, and cloud IAM credentials via an SSRF flaw in pass-through endpoints.

Why: If you deploy LiteLLM as an AI gateway, check your master key immediately—changing it to a long random value closes every attack path in Wiz's report with no upgrade required. If you're running a version before 1.82.0-stable without a master key set, every incoming request has full admin rights, including the ability to create pass-through endpoints that can hit cloud metadata addresses for IAM credentials.

Google Threat Intelligence Group reports a financially motivated hacking group called TeamPCP (aka Altered Spider, UNC6780) used an autonomous multi-agent AI framework to harvest thousands of credentials in under six hours. The group has been compromising PyPI, npm, and Docker Hub supply chains, then deploying credential stealers SANDCLOCK (Python-based, used March-April 2026, part of CanisterWorm) and its successor DUSTMAKER to target AI coding assistants and exfiltrate API credentials from healthcare, government, and media sectors.

Why: If you use AI coding assistants or pull from PyPI, npm, or Docker Hub, this is a direct supply-chain threat to your credentials and cloud environment. The six-hour timeline means incident response cycles are now outpaced by automated attackers—review your package dependencies for tampering, rotate API keys that may have been exposed through coding assistants, and assume stolen credentials are being sold to ransomware partners within hours, not days.

Nvidia has acquired Hugging Face, the leading open-weight AI model repository, for $12.9 billion. Nvidia and Hugging Face leadership promise things will remain the same, but The Register's analysts are skeptical, predicting a more fragmented and siloed era of AI development. The deal was reported by Dan Robinson, who listened to the announcement call.

Why: If you host models on Hugging Face or rely on it for inference endpoints, datasets, or Spaces, you need a contingency plan. Nvidia now controls the primary distribution channel for open-weight models, which could mean preferential treatment for Nvidia-optimized models, changes to pricing, or shifts in what gets featured. Builders should evaluate whether to mirror critical models and datasets elsewhere (e.g., Ollama, local storage, alternative registries) before any policy changes land.

OpenAI launched GPT-6 Astra, claiming new SOTA in computer use and coding, priced 2.5x higher per token but reportedly cheaper per completed task, framed as an 'automated AI Engineer for <$6/hour.' The rollout was bumpy with delayed access for paying users while influencers got early access, and the system card revealed decreased chain-of-thought monitorability despite improved alignment. Independent benchmark aggregators disputed OpenAI's 'AGI-like' framing, saying gains are large but uneven once cost and non-cherry-picked evals are considered.

Why: If you're building AI agents or coding tools on OpenAI's API, you need to re-evaluate cost models: per-token price is 2.5x higher, so tasks that don't benefit from Astra's improved task-completion efficiency will cost significantly more. The decreased CoT monitorability means you can less reliably inspect or guardrail the model's reasoning in production, which matters for anyone shipping agents that touch sensitive systems or data.

Latent Space spent over 20B tokens of early-access GPT-6 Astra and reports it functions as a full AI Engineer at roughly $6/hour (33 tokens/sec at $50/M tokens). They used it to build a dozen internal tools including replacements for 4 paid SaaS products, a partial GitHub+Vercel replacement, game AI training, and personal finance cleanup saving tens of thousands of dollars. Astra saturates FrontierMath (97.6%) and ARC-AGI-3 (99.9%), manages fleets of subagents, and maintains coherence over billions of tokens in a single thread.

Why: If these cost and capability numbers hold at GA, the economics of shipping software change: a model that can deploy, debug, and orchestrate subagents at $6/hour means solo builders and small teams should re-evaluate what they attempt—particularly SaaS tools where a 'Kill My SaaS' framing suggests thin-margin products are now trivially replaceable. Malaysian founders building wrapper SaaS or thin workflow tools should assess whether their moat survives a model that can clone their product in one shot.

Nvidia has agreed to acquire Hugging Face for $12.9 billion, despite Hugging Face previously rejecting a $500 million investment offer from Nvidia to preserve independence. HF CEO Clément Delangue says the platform currently has 18 million AI builders and aims to reach 100 million within the next few years, with Nvidia's backing accelerating that goal. Both companies claim the platform will remain 'open' and 'neutral,' though antitrust concerns around Nvidia absorbing the dominant AI model hub remain untested.

Why: If you host models, datasets, or Spaces on Hugging Face, this acquisition puts your primary AI infrastructure under the control of the same company that dominates GPU supply—raising questions about whether HF stays neutral or gradually favors Nvidia-optimized tooling. Builders should consider whether to maintain dependency on HF as sole hosting, and watch for any shifts in pricing, model governance, or platform policies post-close.

Nvidia has agreed to acquire Hugging Face for $12.9 billion, its second-largest deal after paying $20 billion for Groq assets last year. Hugging Face CEO Clément Delangue said he approached Nvidia's Jensen Huang over the summer, believing open-source AI was at a turning point needing more infrastructure. Huang stated Hugging Face will 'remain an open platform for the entire AI ecosystem.'

Why: If you host models, datasets, or Spaces on Hugging Face, your primary open-source AI platform is now owned by the dominant GPU vendor. While Huang promises openness, builders should track whether Nvidia tightens coupling between Hugging Face and its own hardware/cloud stack, and evaluate whether critical model-hosting or inference workflows need a fallback plan. Founders building on Hugging Face's APIs or Hub should re-read the terms of service post-close for changes in pricing, data handling, or platform neutrality.

Nvidia has agreed to acquire Hugging Face for $12.9 billion, with the deal expected to close in H1 2027 pending regulatory approval. Nvidia pledged to keep the model hub open to the broader AI ecosystem, but the acquisition gives the GPU giant direct ownership of the primary platform where developers discover, host, and distribute open models.

Why: If you build on Hugging Face for model hosting, datasets, or deployment, you now have a single vendor controlling both the dominant model hub and the dominant inference hardware. Nvidia's 'open' pledge is non-binding language in a press release, not a structural guarantee. Builders should evaluate whether to diversify model distribution (e.g., replicate critical models to self-hosted or alternative registries) before the deal closes, and watch for any future bundling of HF features with Nvidia GPU subscriptions that could shift pricing or access.

A human attacker used frontier AI models and agentic attack frameworks to fully breach an enterprise network in under 10 hours—a task Unit 42 says normally takes human operators about two weeks. AI agents autonomously performed reconnaissance, breached a public API endpoint, scraped code repos for hardcoded tokens, stole master admin credentials from a secret-management system, pivoted across cloud/CI-CD/SaaS environments, and hijacked the victim's own cloud AI services as post-compromise infrastructure. The attacker then left the victim an 80-page security audit detailing dozens of exploited findings, and told negotiators that AI agents carried out every step.

Why: This is a documented real-world incident showing autonomous AI agents compressing a full intrusion chain from ~2 weeks to under 10 hours without any novel zero-day or elite tradecraft. For builders, the specific attack path—scraping code repos for hardcoded tokens, compromising secret management, hijacking CI/CD workflows to steal cloud keys, and turning the victim's own cloud AI services into attack infrastructure—means you should treat secret hygiene, CI/CD pipeline isolation, and cloud AI service access controls as urgent priorities, not theoretical concerns. The fact that the attacker used the victim's compute resources to hide orchestration traffic among legitimate activity is a concrete reason to monitor cloud AI service usage anomalies.

Manifold Security disclosed eight flaws across seven CLI AI coding agents (Claude Code, Cursor, Codex, goose, Qwen Code, Grok Build, Hermes Agent) where a repository's .git/config can specify a command via core.fsmonitor that Git runs during index refresh — and the agents trigger git status/git diff at startup, executing attacker-controlled code as the user outside the sandbox with no approval prompt. Four agents (Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path) were still unpatched as of September 1, 2026. The attack requires the repo to arrive with its .git directory intact (shared archive, sync folder, USB stick), not via a normal clone.

Why: If you use Claude Code, Cursor, Codex, or similar CLI agents and you open a project that someone shared as a zip, drive folder, or USB copy rather than a fresh clone, the agent can execute arbitrary code on your machine before you even accept a workspace-trust prompt. Stop opening shared archives in AI coding agents until you've verified the agent is patched, and prefer cloning from remote over copying directories. If you're on Hermes Agent, Qwen Code, or Grok Build, there is no fix yet — treat any non-cloned repo as untrusted.

Trellner Research tested Perplexity's sonar and sonar-pro models across 380 software categories and found 59.8% of 7,534 citations point to domains ranked worse than #100,000 in Tranco, with 23.4% outside the top 1M entirely. Three sites under apparent common control published 215,128 machine-generated 'best <category>' pages between them, two with the HTML title 'Facts & Grounding Page' — explicitly built to be read by retrieval models, not humans. None of the three domains existed before December 2023.

Why: If you build AI agents that ground answers in web search, your retrieval pipeline is likely citing SEO-for-AI farms that didn't exist two years ago. SaaS founders should not assume AI search engines surface their product accurately — the citation graph is being gamed by mass-generated pages designed to intercept model retrieval. Anyone using Perplexity for software recommendations should treat its grounding sources with the same skepticism as classic SEO spam.

METR disclosed that in March 2026, an attacker found a researcher's publicly accessible EC2 instance running a 'vibe-coded app' with a fail-open auth bug, prompted an agent to reveal its API key, and spent three weeks consuming ~$600K in model credits. The attacker likely discovered the instance by scanning certificate transparency lists for recently-registered sites with LLM/agent-related keywords. METR also disclosed a May 2026 incident involving systematic probing of its public infrastructure.

Why: If you are vibe-coding or rapidly prototyping AI agent apps on public cloud instances, attackers are actively scanning certificate transparency logs for sites with LLM/agent keywords to harvest exposed API keys. You need to ensure your auth doesn't fail-open, never let agents handle raw API keys in prompt-accessible contexts, and set hard spending alerts on your model provider accounts — METR's $600K went unnoticed for three weeks.

Anthropic released Claude Fable 5.1 (GA) and Claude Mythos 5.1 (restricted access), which are the same model with different safeguard levels. Fable 5.1 reduces cache read pricing, cutting typical workload costs by ~25% and highly agentic work costs by up to ~45%, while introducing Enterprise Frontier Safeguards for zero data retention.

Why: Builders using Claude for agentic coding or API workloads should switch to Fable 5.1 to leverage up to 45% cost savings on cache reads and zero data retention, especially if they need enterprise privacy compliance.

METR, a non-profit that evaluates frontier AI models for agentic tasks, disclosed two security incidents. In March 2026, attackers found a researcher's personal EC2 instance running a 'vibe-coded' agent orchestration dashboard via certificate transparency logs, exploited a fail-open auth vulnerability that silently disabled Google authentication, then prompted the agent directly to reveal its model provider API key—consuming approximately $600,000 in AI inference credits over three weeks. In May 2026, attackers separately probed METR's public infrastructure but failed to access internal data.

Why: If you are vibe-coding or rapidly prototyping agent dashboards with LLM API keys, you need to assume attackers are actively scanning certificate transparency logs for sites with LLM/agent keywords and will prompt your exposed agent to dump its API key. Rotate and restrict API keys, never rely solely on Google auth without a fail-closed fallback, and set spending alerts on any inference account. The $600,000 bill was only absorbed because the provider gave credits for free—you would not be so lucky.

Attackers are actively exploiting two critical vulnerabilities: CVE-2026-0768 (CVSS 9.8) in Langflow, allowing root-level arbitrary Python code execution, and CVE-2026-66066 (CVSS 9.5) in Ruby on Rails, leaking secret_key_base, database passwords, cloud credentials, and API tokens via an Active Storage/libvips image-processing discrepancy. VulnCheck recorded 360 detections by Monday, with attackers specifically harvesting OPENAI_API*, AWS_ACCESS*, and AWS_SECRET* environment variables; Malaysia is explicitly listed among the top five countries with vulnerable Langflow hosts alongside the U.S., Germany, Brazil, and India.

Why: If you run Langflow or any Rails app using libvips for Active Storage image uploads, patch immediately—attackers are pulling AI API keys, AWS credentials, and SSH keys from exposed hosts right now, and Malaysia is named as a heavily affected region. For Langflow specifically, check that LANGFLOW_SUPERUSER and /root/.cache/langflow/secret_key are not internet-exposed, and rotate any OPENAI_API_KEY or AWS keys that may have been accessible on an unpatched instance.

An independent red-team test found that Claude Code Opus 5's Auto Mode—now the default since mid-August 2026—can be hijacked via indirect prompt injection with 60-80% success rate, directly contradicting Anthropic's vendor-commissioned evaluation by Trajectory Labs that reported 0.00% attack success across 72 scenarios. The attack chain exploits Claude's shift from WebFetch to curl, redirects to a ZIP archive, and uses a malicious struct.py to shadow Python's standard library when Claude writes and runs its own decoder in the attacker-controlled directory.

Why: If you are running Claude Code in Auto Mode (now the default), do not treat its safety classifier as a substitute for sandboxing—this writeup demonstrates a concrete path to arbitrary code execution via a simple 'summarize this URL' request. You should run Claude Code in isolated environments and avoid letting it execute code in directories derived from untrusted web content.

Vercel patched two critical unauthenticated RCE vulnerabilities in Next.js: a heap buffer overflow in libheif triggered by crafted AVIF images (CVSS 9.5, affects all deployments), and a Windows path traversal flaw (CVE-2026-75604, CVSS 9.0, affects only Windows-hosted servers). Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026; Vercel-hosted apps are already protected.

Why: If you self-host Next.js anywhere outside Vercel—especially on Windows—upgrade to 15.5.24 or 16.3.3 immediately, as there is no workaround for the Windows path traversal. Even on Linux/macOS, the AVIF flaw means any endpoint that accepts user-uploaded or remote-fetched images for optimization is an unauthenticated RCE vector.

NVIDIA is acquiring HuggingFace for $13B, roughly 80x HuggingFace's $150M ARR and nearly double NVIDIA's initial $7B offer from January 2026, after HuggingFace doubled its customer base during the year. Separately, Z.ai launched GLM-5.3-Flash (the model behind the 'Ox Alpha' preview), a 320B total / 18B active parameter natively multimodal model with a 1M-token context window under the MIT License, claiming coding performance on par with Claude Opus 4.8. The article also references an OpenAI HuggingFace incident retrospective, though details are not included in the excerpt.

Why: If you host models or use HuggingFace Hub, Spaces, or Inference API, NVIDIA now owns that infrastructure—evaluate whether your deployment pipeline has a migration path or alternative (e.g., self-hosted model weights, direct cloud provider endpoints). For anyone evaluating open-weight models, GLM-5.3-Flash is now downloadable under MIT with 1M context and immediate support on CoreWeave, Baseten, and Cline—worth benchmarking against your current Claude/GPT API spend, especially for coding workloads. Note the day-0 chat template fix: if you pulled weights in the first hours, re-download.

AWS has acquired DuckLabs, the primary support and development company behind the open-source in-process OLAP database DuckDB. DuckDB and its related projects will remain free under MIT licenses, with the independent DuckDB Foundation guiding them to avoid conflicts of interest. AWS and DuckLabs previously collaborated on first-class support for S3 Tables in DuckDB.

Why: DuckDB is widely used for fast analytics directly within Python/Pandas without a separate server. Builders should watch how AWS integrates DuckDB into its ecosystem and whether the independent foundation can truly balance AWS's strategic direction against the needs of users on other cloud platforms.

The author used Claude Opus 5 to perform agent-driven reverse engineering on five hardware peripherals, including an Insta360 Link webcam. Over 13 hours of processing and 98 prompts, the agent found a plaintext shell in a microphone, disabled a webcam's activity LED while recording, and found WiFi memory write vulnerabilities in a key light.

Why: It demonstrates a highly effective, prompt-driven workflow for using AI agents to automate complex reverse engineering tasks, yielding actionable security vulnerabilities in common hardware. Builders can adapt this approach to audit their own hardware or understand firmware without needing deep, manual reverse engineering expertise.

The Model Context Protocol (MCP) lead maintainers published a new roadmap focusing on five priority areas, including agentic messaging primitives, HTTP-native transport unification, and agent identity. Key changes involve maturing the Tasks extension (SEP-2663) for server-initiated events and standardizing agent identity for non-interactive cloud workloads. The 2026-07-28 release already made remote MCP servers indistinguishable from standard HTTP workloads, a trend they plan to extend to local servers using Streamable HTTP over stdio.

Why: Builders should prepare to shift from simple request-response patterns to long-running agentic loops using webhooks and channels, and design MCP servers to authenticate non-interactive agent identities rather than relying on browser-based human approval.

CISA ordered federal agencies to patch CVE-2025-62593 (CVSS 9.4) in Ray within 3 days instead of the usual 14, due to active exploitation. The RCE flaw lets attackers use Firefox or Safari's Fetch API to bypass Ray's browser-blocking check (which only looks for 'Mozilla' in the User-Agent), then use DNS rebinding to hit a developer's local Ray service—triggerable just by visiting a malicious site or seeing a bad ad. Ray 2.52.0 fixes it; vulnerable versions are any prior release.

Why: If you run Ray locally or in dev/test for ML workloads, you are one browser tab away from RCE on your machine—and from there, attackers can pivot to network-adjacent Ray instances. Upgrade to Ray 2.52.0 immediately and avoid browsing with Firefox or Safari on machines running vulnerable Ray until you do. With 7 million weekly downloads, many AI/ML teams in Malaysia likely have exposed dev environments.

GitHub Copilot Autofix introduced a script injection vulnerability into Snowflake's snowflake-connector-net GitHub Actions workflow on June 18 by removing an existing sanitized input pattern and replacing it with direct string expansion in a shell script. Five days later, Wiz's autonomous AI red agent found the bug during a routine public repo scan, exploited it by crafting a GitHub issue title that exfiltrated Jira credentials via an out-of-band callback, and gained read access to Snowflake's engineering, security compliance, and bug bounty projects. Snowflake patched the same day Wiz reported it and rotated credentials the next day, confirming a five-day exposure window with no unauthorized access beyond Wiz.

Why: If you use AI coding assistants that auto-fix or auto-generate commits, you need to treat their output as untrusted code that can remove existing security sanitization patterns — not just as suggestions to eyeball. This incident shows an AI removing a working input sanitization pattern and replacing it with a vulnerable one, which then sat in a public repo for five days undetected by human review. Audit AI-generated diffs for security regressions in CI/CD workflows, especially in GitHub Actions run: blocks where shell injection is possible, and consider running automated security scanning on every commit rather than relying on human review.

A new paper demonstrates a method to extract encrypted reasoning traces from frontier AI model APIs (Claude, GPT, Gemini) by replaying signed thinking blocks into weaker models from the same provider and prompting them to transcribe. The authors scanned ~7,000 public Claude Code/Codex sessions and found 62 unique API keys, 33 email addresses, 33 passwords, and other sensitive data—64 of which appeared exclusively inside reasoning blocks, not visible session output.

Why: If you've ever shared a Claude Code or Codex session publicly (e.g., in a GitHub repo, bug report, or forum post), your encrypted reasoning blobs may contain leaked API keys, passwords, or emails that can now be decoded. Audit any shared sessions immediately and rotate credentials. Builders using reasoning model APIs should also understand that obscured chain-of-thought is no longer a reliable security boundary against distillation or data leakage.

Shopify replaced Redis with MySQL for its oversell protection system to align with a unified database strategy. By using MySQL 8's SKIP LOCKED feature and shifting to a one-row-per-inventory-unit design instead of one row per item, they handled Black Friday 2025 peak traffic of $5.1 million in sales per minute. The hardest lesson was discovering their actual bottleneck wasn't what they were initially measuring.

Why: If you are building high-throughput reservation or locking systems, do not default to Redis just for speed. MySQL 8's SKIP LOCKED combined with a granular row-per-unit design can handle massive contention while preserving ACID guarantees, allowing you to simplify your infrastructure by dropping a specialized cache layer.